What is the CVSS score of CVE-2026-39531?

CVE-2026-39531 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Directory Kit are affected by CVE-2026-39531?

WP Directory Kit WordPress plugin versions 1.5.0 and earlier expose organizations using this plugin to unauthorized database access and service disruption through a critical vulnerability requiring…

How to fix or mitigate CVE-2026-39531?

Within 24 hours: Inventory all WordPress installations using WP Directory Kit version 1.5.0 or earlier; immediately deactivate the plugin across all instances; document affected sites and database scope. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking SQL injection patterns; enforce database user permissions to principle of least privilege; implement database activity monitoring and alerting. Within 30 days: Monitor Patchstack and official plugin repository for vendor-released patch; perform forensic audit of affected installations for exploitation indicators; prepare upgrade plan to patched version upon availability.

WP Directory Kit CVE-2026-39531

EUVD-2026-31291 CRITICAL

SQL Injection (CWE-89)

2026-05-21 Patchstack

GHSA-q5xx-h8cq-mvvf

WordPress SQLi Wp Directory Kit Wordpress Plugin

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 16:30 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection.

This issue affects WP Directory Kit: from n/a through 1.5.0.

AnalysisAI

Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.0) allows remote unauthenticated attackers to inject SQL commands through improperly neutralized input. With a CVSS 9.3 (scope-changed) rating from Patchstack, successful exploitation can expose sensitive database contents and partially impact availability across the WordPress installation. No public exploit identified at time of analysis and the plugin is not currently listed in CISA KEV.

Technical ContextAI

WP Directory Kit is a WordPress plugin used to build directory listing sites (businesses, members, classifieds). The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL queries without proper parameterization or escaping via WordPress's $wpdb->prepare() API. Because the impact is 'blind', the attacker does not receive direct query output and instead infers data via boolean or time-based side channels. The CPE cpe:2.3:a:wp_directory_kit:wp_directory_kit:*:*:*:*:*:*:*:* covers all released versions through 1.5.0.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists the issue only against versions through 1.5.0 without a confirmed fixed version in the provided data, so administrators should monitor https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-0-sql-injection-vulnerability and the plugin's WordPress.org page and upgrade to any release above 1.5.0 once published. Until a fix is available, deactivate and remove the WP Directory Kit plugin if business-tolerable, since this immediately removes the vulnerable code path at the cost of losing directory functionality. As compensating controls, place the site behind a WAF such as Patchstack mTrap, Wordfence, or Cloudflare with SQLi rules enabled and specifically block requests containing SQL meta-characters to the plugin's AJAX/REST endpoints (note this may break legitimate searches with apostrophes), restrict access to the directory pages to authenticated users via plugin or .htaccess rules where feasible, and rotate WordPress secret keys plus force-reset user passwords if exploitation is suspected because hashed credentials may have been exfiltrated.